Certain upstream switch to `firewall4` aka `nftables` instead of `iptables`

[aparcar]

Hi all, especially @openwrt/luci-admin,

for the next OpenWrt release firewall4 is considered as a replacement of the current iptables based firewall package. While the configuration stays within /etc/config/firewall, packages using iptables directly may see trouble.

This is a heads up for everyone maintaining such packages but also please post packages here that would be affected so a smother migration is possible.

Heads up for packages.git: openwrt/packages#16818
Heads up for routing.git: openwrt/routing#731

[aparcar]

Heads up, firewall4 gets into a fine state (thanks to @stintel and @jow- )and I'm planing to make it the default within the next week. For all scripts that require legacy iptables please test your apps with iptables-nft and report back!

[hnyman]

I think that that Status->Firewall menu item and page is still totally iptables based after 48599d8, right?

https://github.com/openwrt/luci/blob/master/modules/luci-mod-status/htdocs/luci-static/resources/view/status/iptables.js

[castillofrancodamian]

Heads up, firewall4 gets into a fine state (thanks to @stintel and @jow- )and I'm planing to make it the default within the next week. For all scripts that require legacy iptables please test your apps with iptables-nft and report back!

I cannot find the iptables-nft package.

[aparcar]

Yea sorry the iptables-nft package is currently missing, should be fixed via openwrt/openwrt#4957

[castillofrancodamian]

Yea sorry the iptables-nft package is currently missing, should be fixed via openwrt/openwrt#4957

I already found the iptables-nft package. Do you also have to install iptables and firewall or just firewall4 and iptables-nft?

[aparcar]

@castillofrancodamian maybe @stintel can comment better than me but from my understanding you could install firewall4 and iptables-nft, both will use NFTables while keeping backward compatibility with the iptables wrapper.

[castillofrancodamian]

@castillofrancodamian maybe @stintel can comment better than me but from my understanding you could install firewall4 and iptables-nft, both will use NFTables while keeping backward compatibility with the iptables wrapper.

Likewise, installing iptables-nft also installs iptables. The "real problem" is that I can't edit any firewall zones with the error "Cannot convert undefined or null to object" in LuCI.

[aparcar]

As discussed at yesterdays meeting I merged the changes. The next release will use firewall4 as default and all packages incompatible (e.g. using ipset) should add a negative dependency. Our considerations are that the default (WiFI home router) setup works fine wir firewall4 and special cases can always replace firewall4 with firewall3, which should work at least until the upcoming 5.15 Kernels.